Opinion
Opinion By: Jack Conway, Attorney General; Amye L. Bensenhaver, Assistant Attorney General
Open Records Decision
The question presented in this appeal is whether the Cabinet for Health and Family Services, Department of Community Based Services, met its burden of proof in wholly redacting information that it characterized as "personally identifiable, information" and "protected health information," from the records it provided to Mr. Scott White, an attorney representing a municipality. On April 16, 2015, Mr. White requested "the completed Form 866A's on any children/youths 1 admitted by DCBS to the Bellewood facility of Uspiritus Inc., from January 1, 2013, through the present." He agreed to the redaction of all personally identifiable information relating to the minors. He later requested that the Cabinet provide him with "a single exemplar explaining the Cabinet's redaction, " as a starting point for discussion, rather than all responsive records. The Cabinet complied with his request by producing two redacted "exemplars, " advising Mr. White that it redacted the minor's personally identifiable information pursuant to KRS 620.050(5) and protected health information pursuant to 45 C.F.R. Part 160 and Subparts A and E of Part 164. 2 This open records appeal followed. 3
In his letter of appeal, Mr. White described DCBS's role in voluntarily or involuntarily placing minors under its care and the use of Form 886A in that process. The form, he explained, is created by the minor's assigned social worker as part of his/her "level of care packet. " The packet is forwarded to the "gatekeeper," currently Bluegrass Mental Health, Inc., which assesses the minor's packet, along with other materials, and determines his/her required level of care. Using a scale of I through V, the social worker makes a placement decision that may include foster care, a residential facility, or a psychiatric facility. Form 886A remains a part of the minor's DCBS file.
Mr. White then identified a wide range of information that was and was not redacted from the Form 866A "exemplars" with which the Cabinet provided him. He explained:
. the minor's date of birth, gender, race, height, weight, county of commitment, and region were not redacted, but the minor's name, social security number, and religious preference were redacted;
. the nature of the minor's placement and any prior placements were not redacted, but the details of his/her current placement were redacted;
. the minor's strengths, interests, and special activities, status as the parent of his/her own child, past "legal history," if any, and the reasons therefore, were not redacted, but case identifiers were redacted;
. the minor's "daily living skills checklist" and "history of abuse/neglect checklist" were not redacted, but the reasons for previous findings of abuse or neglect were redacted;
. the highest grade attained by the minor and whether he/she was employed in the past were not redacted, but the names of the minor's school or past employers were redacted; and
. the minor's permanency plan was not redacted.
Mr. White did not object to the Cabinet's decision to de-identify the requested records by withholding, for example, case names and numbers, current custody status, details of current placement, mental health issues and needs (including psychotropic medications), I.Q., medical history, and family background.
Instead, Mr. White focused on Section G of Form 866A, captioned "Behavior Narrative," which the Cabinet redacted in its entirety. Section G contains a series of prompts aimed at ascertaining if the minor is a danger to him/herself or others; if the minor exhibits aggressive behavior, including setting fires; if the minor is a runaway or AWOL risk; if the minor sexually acts out or is a "sexual perpetrator;" if the minor or his family members has (have) a history of alcohol or drug abuse; and the minor's "delinquency behavior patterns" and "other behaviors." Contrasting the redacted information in Section G to the information that the Cabinet released to him, including date of birth, race, weight and height, prior placements, strengths, activities and interests, conduct that resulted in his/her involvement in the juvenile justice system, past employment, and permanency plan, Mr. White asserted that there "is no difference as to the character of the information withheld" in Section G and the character of the information released in the other sections of Form 866A. (Emphasis in original.) Relying on 14-ORD-113, he argued that the Cabinet could have just as easily "de-identified" the information in Section G as it "de-identified" the information released to him.
On appeal, the Cabinet again maintained that KRS 620.050(5) authorized nondisclosure of personally identifiable information and that HIPAA authorized nondisclosure of protected health information. It did not amplify on this position except to note that:
the documents requested are confidential and not subject to release pursuant to KRS 620.050(5) because the documents contain information which have been obtained by the Cabinet as a result of an investigation or assessment of a minor in the custody of the Cabinet and made pursuant to KRS Chapter 620. In an effort to be as cooperative as possible, the Cabinet redacted what it believes to be the minor's protected health information including information on the minor's behavior and produced those documents in response to the open records request. 4
Because the Cabinet failed to meet its burden of proving a reasonable basis for denying, in whole, access to personally identifiable and protected health information in Section G, the "Behavior Narrative," while releasing de-identified personally identifiable and protected health information appearing in other sections of the Form 866A's, we cannot affirm its position.
To begin, the Cabinet cites no legal authority supporting its position that "behavior" constitutes personally identifiable information under state law. KRS 620.050(5) contains no reference to personally identifiable information. The definitions for Chapter 620, found at KRS 620.020, do not define the term. The administrative regulations make reference to "personally identifiable information" in several places, none here pertinent. 5 The Kentucky Supreme Court has opined that "personally identifiable information," in the context of a dispute involving the application of state and federal laws governing release of student education records, 6 "would include information that makes the identity of the student easily traceable, such as a name, address, or personal characteristics." In 08-ORD-166, the Attorney General rejected the Cabinet's argument that a description of a Bluegrass/Oakwood Communities' resident's position in her wheelchair, and abrasions and contusions to her body, constituted personally identifiable information. We compared a copy of a less heavily redacted investigative report relating to the resident that was previously released to a copy of a more heavily redacted investigative report that employed a new redaction policy adopted by the Office of Inspector General. We reasoned that although the earlier redacted report described the condition of the Oakwood resident which gave rise to the investigation it did not identify the resident by name, age, birthdate, Social Security number, photograph, or any other personal identifier. Accordingly, we concluded that there was "no reasonable basis to believe that the redacted information could be used to identify the individual." 08-ORD-166, p. 9. 7 The Cabinet did not appeal 08-ORD-166 and cites no conflicting authority.
Nor does the Cabinet cite any legal authority supporting its position that "behavior" constitutes protected health information under HIPAA's Privacy Rule that cannot be de-identified. 45 C.F.R. 160.103 defines "protected health information" as "individually identifiable health information" and "individually identifiable information" as "information that is a subset of health information, 8
(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
(2) Relates to the past, present, or future physical or mental health or condition of an individual; or the past, present, or future payment for the provision of health care to an individual; and
HIPAA establishes a "de-identification" standard for protected health information. 9 A covered entity may de-identify protected health information by two means, only one of which is relevant here. 45 C.F.R. 164.514 (b)(2) 10 permits de-identification by removal of the individual's, or his/her relatives', employers,' or household members': names, geographic subdivisions smaller than a state, all elements of dates (except year), telephone and fax numbers, email addresses, Social Security numbers, medical records numbers, account numbers, certificate/license numbers, vehicle identifiers, device identifiers, URLs, IP address numbers, biometric identifiers, full face photographic images, and "any other unique identifying number, characteristic, or code." This was the de-identification method employed by the Cabinet in producing "exemplars" of redacted records responsive to Mr. White's request with respect to all sections of the Form 866A's except one: Section G.
Having failed to demonstrate that Section G "Behavior Narrative" of Form 866A could not be de-identified using the same method employed in de-identifying the other sections of the form, we conclude that the Cabinet did not meet its statutorily assigned burden of proving a reasonable basis for withholding Section G in its entirety. Mr. White relies chiefly on 14-ORD-113 11 for the position that, having undertaken the de-identification of all other sections of Form 866A, the Cabinet was required to de-identify Section G as well and thereafter disclose those entries, or portions of entries, that were not individually identifiable. He argues that, "if the information sought to be exempted from disclosure does not permit the identification of the person then it is deemed 'non-identifiable,' is not "personally identifiable information, " and is not exempt from disclosure. " 12 On the facts presented, and given the Cabinet's failure to satisfy its burden of proving that there is a reasonable basis for treating the "behavior narrative" in Form 866A as uniquely personally identifiable, or protected health information that is incapable of de-identification when all other sections of the form were de-identified, we agree with Mr. White. KRS 61.880(2)(c) assigns the burden of proof in sustaining its actions to the agency. Accord,
City of Ft. Thomas v. Cincinnati Enquirer, 406 S.W.3d 842, 848 (Ky. 2013) (recognizing that "agency . . . bears the burden of proof . . ., and what it must prove is that any decision to withhold responsive records was justified under the Act"). The Cabinet offered no proof of a reasonable basis for distinguishing Section G of the Form 866A's to which Mr. White requested access, that it withheld in its entirety, from Sections A through R that it de-identified and released to Mr. White. Because the Cabinet failed to meet this burden, the question Mr. White raises on appeal must be resolved in his favor.
Either party may appeal this decision by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Footnotes
Footnotes
1 For brevity's sake, we will refer to these "children/youths" as minors.
2 The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.
3 On appeal, Mr. White noted that the Cabinet did not cite KRS 61.878(1)(k) and (l), as required by KRS 61.880(1), in its response. The response was, to this extent, defective.
4 KRS 620.050(5) restricts access to "the report of suspected child abuse, neglect, dependency, and all information obtained by the Cabinet or its delegated representative, as a result of an investigation or assessment made pursuant to [Chapter 620]" excluding nine categories of individuals or entities from this rule of nondisclosure. Mr. White's client does not fall within any of these excepted categories. In this instance, the Cabinet may have elected to waive the access restriction because Mr. White requested only de-identified information. Compare, 03-ORD-070 (affirming Cabinet's denial of grandmother's request for records relating to her grandchildren because she did not fall within one of the categories of individuals excepted from the general rule of nondisclosure established under KRS 620.050(5) and the records could not be de-identified). The Cabinet's efforts at cooperation also suggest that it may have proceeded under KRS 61.878(5), promoting agency sharing of otherwise exempt records with another agency when the sharing is serving a legitimate governmental need.
5 For example, 707 KAR 1:020, containing definitions for special education programs in local school districts, defines "personally identifiable information" as "information that includes the name of the child, the child's parents or other family members, the address of the child, a personal identifier, including the child's Social Security number or student number, or a list of personal characteristics or other information that would make it possible to identify the child with reasonable certainty."
6 State law addresses access to student education records at KRS 160.705 and federal law addresses the same topic at 20 U.S.C. § 1232g.
7 Our analysis proceeded under KRS 194A.160(1), authorizing nondisclosure obtained in the investigation of a state owned and operated facility for individuals with developmental disabilities if the information "directly or indirectly identif[ies] a client or patient . . . ."
8 Health information" is defined in 45 CFR 160.103 as:
any information, including genetic information, whether oral or recorded in any form or medium, that:
(1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse, and
(2) Relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.
9 The standard for de-identification of protected health information is found at 45 C.F.R. 164.514(1) which states, "Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information."
10 This method is referred to as the "Safe Harbor" method. It was the method utilized by the Cabinet in 14-ORD-113 upon which Mr. White relies.
11 As noted, in 14-ORD-113 this office recognized the propriety of the Cabinet de-identification of protected health information using the "Safe Harbor" method. Its consistant utilization of the method in that appeal stands in contrast to its random utilization of the method in this appeal.
12 The redacted and unredacted "exemplars" provided to this office by the Cabinet pursuant to KRS 61.880(2)(c) reveal that the "Behavior Narrative" is not a "narrative" but instead a series of brief entries submitted in response to prompts. These prompts are as follows:
1. Danger to self and/or suicidal behavior:
2. Danger to others and/or aggressive behavior:
3. History of fire setting:
4. Runaway/AWOL/risk:
5. Sexual acting out/sexual perpetrator:
6. Alcohol/Drug History/Use:
7. Delinquency behavior patterns:
8. Other behaviors . . . [.]
Many of the prompts are answered by a simple "yes" or "no." With respect to brief responses, Mr. White suggests, by way of example, the appropriate "Safe Harbor" de-identification method:
1. John uses methamphetamine which can be physically harmful.
1. uses methamphetamine which can be physically harmful.
2. John has attacked four students in the last two months at Lafayette Middle School in Lexington.
2. has attacked students in the last months at
4. John ran away two times to his older sister, June, a student at Bellarmine.
4. ran away two times to his older sister, .
5. John has a steady girlfriend, Susie Brown, with whom sexual intercourse is strongly suspected.
5. has a steady girlfriend, , with whom sexual intercourse is strongly suspected.
Based on a review of "exemplars" provided to this office under KRS 61.880(2)(c), we believe this is a workable, and reasonable, de-identification method.